Expose RegisterPostProcessor in the libprotobuf-mutator wrapper - #113
Open
ChrisJr404 wants to merge 1 commit into
Open
Expose RegisterPostProcessor in the libprotobuf-mutator wrapper#113ChrisJr404 wants to merge 1 commit into
ChrisJr404 wants to merge 1 commit into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #58. Exposes libprotobuf-mutator's
RegisterPostProcessorthrough the wrapper so you can fix up a mutated proto before it reaches your test function.The mutator flips fields without knowing anything about your message's invariants, so it happily produces protos that your target rejects early: a length field that no longer matches a repeated field, a stale checksum, an enum that's really a bitmask. libprotobuf-mutator already has a hook for exactly this (
RegisterPostProcessor, see google/libprotobuf-mutator'smutator.cc), there just wasn't a way to reach it from Python.New surface:
The callback gets the freshly mutated message and the seed. You can mutate it in place or return a replacement; returning
Nonekeeps your in-place edits. Registration is global per message type (that's how libprotobuf-mutator keys it), so you call it once beforeFuzz().On the C++ side the binding pulls the descriptor off a prototype instance and hands libprotobuf-mutator a
std::functionthat calls back into Python. Because the native proto caster hands Python a copy, the Python helper always returns the message and the binding copies it back into the one the mutator owns — so plain in-place edits actually take effect. It follows the samestd::unique_ptr<protobuf::Message>bridging the existingCustomProtoMutator/LoadProtoInputbindings use. Purely additive, existing API is untouched.Test:
testPostProcessorinproto_fuzz_test.pyregisters a post-processor that rewrites every mutatedStringValueto the solving value, so the existing comparison harness reportsSolvedon the first input instead of waiting for the mutator to find"abc"on its own. If the post-processor's edits didn't make it back into the bytes the fuzzer feeds the harness, that test would time out.One note on building/verifying: I couldn't build the native extension in my environment (no bazel/protobuf-C++/pybind toolchain handy), so I verified the Python surface end to end against a stubbed
_mutatorthat emulates the copy-in/copy-back the caster does, and checked the C++ against the libprotobuf-mutator v1.0 signature pinned inWORKSPACE. Worth a real build in CI before merge. I've signed the Google CLA.